Your accounts stay yours.
Castlune is designed to act only with your permission and without collecting social-network passwords.
Official account authorization
Instagram, TikTok, YouTube and X connect through their official authorization flows. Telegram connects through a bot token supplied by the channel owner. Castlune does not collect social-network passwords or private messages.
Encrypted credentials
Access tokens, refresh tokens and Telegram bot tokens are encrypted before storage and are never displayed again in the interface. They are used only by server-side functions needed for the selected integration.
Least access needed
Castlune requests the permissions needed to identify a connected account and prepare or send content you explicitly select. Permissions and integration availability are reviewed as provider requirements change.
Controlled publishing
Connecting an account does not authorize a post. You choose the content and destinations and confirm a publish action. A queued or scheduled record is not presented as a completed platform publication.
Disconnect and deletion
Connected credentials can be removed from Accounts. Complete Castlune workspace deletion is available in Settings → Security. You can also revoke access in the destination platform. Read the Data deletion instructions for the complete process.
Responsible disclosure
If you believe you found a security issue, email 8686222@gmail.com or use the contact form and include “Security” in the first line. Do not include passwords, bot tokens or OAuth credentials. Please allow a reasonable opportunity to investigate before public disclosure.